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The Chief Executive 
All Authorized Institutions 


Dear Sir / Madam, 


Guidance on Sharing Customer Data by Authorized Institutions for Direct 
Marketing by Third Parties 


I am writing to provide guidance to authorized institutions (“AIs”) on sharing 
of customers’ personal data with third parties, including group companies of 
Als (collectively referred to as “third parties”), for direct marketing by such 
third parties, following industry consultation. 


While Als collect personal data of customers through online channels including 
mobile apps for their own operational and direct marketing purposes, there are 
increasing occasions that Als may also provide such personal data collected to 
third parties such that the third parties may use such personal data for their own 
direct marketing purpose. 


Given the special trust relationship between AIs and their customers, and 
considering that some of the third parties are not subject to any regulatory 
regime like that of Als, for the sake of better safeguarding personal data of 
banking customers, the Hong Kong Monetary Authority (“HKMA’’) considers 
that the banking industry should aspire to a higher standard regarding sharing 
of customers’ personal data with third parties for the purpose of direct marketing. 


Under the guidance, there are two general approaches that Als may adopt for 
sharing customers’ personal data for direct marketing by third parties: (1) by 
asking customers to directly approach the third parties such that the customers 
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may provide their personal data directly to the third parties; or (11) redirecting 
the customers from Als’ website / mobile apps to the websites / mobile apps of 
the third parties (“redirection”) for provision of their personal data and/or 
consent for direct marketing by such third parties. The guidance also stipulates 
how redirection should be made, the types of customers’ personal data that may 
be shared with third parties in different circumstances under the redirection 
approach, and other guiding principles on the sharing of customers’ personal 
data to third parties. Detailed guidance is contained in the Annex. 


Implementation 

The guidance will take effect on 1 January 2022 such that any new applicable 
initiatives to be launched by Als from that date should comply with the guidance. 
For Als’ existing applicable arrangements, Als are expected to comply with the 
guidance as soon as practicable and in any case not later than 6 months from the 


effective date (1.e. by 30 June 2022). 


If you have any questions on this circular, please contact Mr Ken Lee on 2878- 
1357 or Ms Kacey Chan on 2878-8310. 


Yours faithfully, 


Alan Au 
Executive Director (Banking Conduct) 


Encl. 


c.c. Office of the Privacy Commissioner for Personal Data 
(Attn: Ms Ada Chung, Privacy Commissioner for Personal Data) 


